Predictfunclaw

Predict.fun skill with a PolyClaw-style CLI for markets, wallet funding, trading, positions, and hedging.

This skill largely does what it claims (markets, wallet status, vault bootstrap, trading, optional hedge analysis), but exercise caution before giving it secrets. Specific points to consider: - Only provide the minimal environment variables for the mode you intend to use. Use fixture or read-only templates first to verify CLI behavior without secrets. - The registry metadata lists many private keys and an LLM API key as required, but the docs state these are conditional per mode — treat the manifest's long 'required' list as an over-declaration and don't paste all keys into .env. Prefer supplying keys only when you run a flow that needs them. - The skill can run an external subprocess (erc-mandated-mcp) and, after explicit confirmation, broadcast on-chain transactions and backfill ~/.openclaw/skills/predictclaw/.env. Review lib/mandated_mcp_bridge.py and scripts/* to confirm exactly what the subprocess receives before running any '--confirm' deployment steps. - OPENROUTER_API_KEY enables hedge/LLM features. If you enable hedge analysis, understand that data (market context, positions) may be sent to an external LLM provider. Avoid sending private keys or other secrets to the LLM and consider using a dedicated (limited-scope) API key. - Audit the npm package @erc-mandated/mcp and the brew 'uv' formula you will install (check publisher and release source) before one-click installs. Because vault bootstrap touches funds, ensure prerequisites and package provenance are trustworthy. - Test in the 'template.env' (fixture) or 'template.readonly.env' modes first. Only run bootstrap/confirm commands when you intentionally want to perform chain-side actions and after confirming the code paths involved. If you want, I can point out exact files and functions that spawn subprocesses or write .env so you can review them before installing.

Type: OpenClaw Skill Name: predictclaw Version: 0.1.34 PredictClaw is a legitimate and well-architected trading tool for the predict.fun platform. It handles sensitive information, including blockchain private keys and API tokens, but implements robust security practices such as automated secret redaction in logs and error messages (found in lib/config.py and lib/api.py). The skill utilizes an external MCP (Model Context Protocol) runtime via subprocess execution (lib/mandated_mcp_bridge.py) to manage 'mandated vaults'; while this is a high-privilege capability, it is used strictly for the stated purpose, employs safe command parsing with shlex, and requires explicit user confirmation for on-chain actions. Design documentation within the bundle specifically addresses risk reduction by avoiding automatic package installations or silent environment modifications.